4d5e9a81aaec53df6bcade23ae5638527224affdfa165c72fe16299131bb1450

Analysis

max time kernel
117s
max time network
133s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04-10-2024 11:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SilverBullet.1.4.1.Pro/SilverBullet 1.4.1 [Pro]/lib/email/_header_value_parser.py
Size

105KB
MD5

6679552a6ae3722f8dc4d22956f33ed5
SHA1

c4a54745286306e61a93f149c00af4198e7921a4
SHA256

962d240c01afc8ef58278fe55ec0159ac1a315a7ec9498eda1722ab06b3c4f04
SHA512

6ace7ea53b624afb57e6f7faa70685dc02bf5080e454ebe04d3c28cc28df50f340e11376a0c3a666b222948fad25f1036105173e8b234d7103e12c83407426d3
SSDEEP

1536:MymtUMsnhM4B6ZAV7/cZoiJWn7sx03rf1Xu/6V7asGY7:I+5hBaAV7/cw7sxa

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2788	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2788	AcroRd32.exe
2788	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1544 wrote to memory of 2536	1544	cmd.exe	30
PID 1544 wrote to memory of 2536	1544	cmd.exe	30
PID 1544 wrote to memory of 2536	1544	cmd.exe	30
PID 2536 wrote to memory of 2788	2536	rundll32.exe	31
PID 2536 wrote to memory of 2788	2536	rundll32.exe	31
PID 2536 wrote to memory of 2788	2536	rundll32.exe	31
PID 2536 wrote to memory of 2788	2536	rundll32.exe	31

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\SilverBullet.1.4.1.Pro\SilverBullet 1.4.1 [Pro]\lib\email\_header_value_parser.py"
1⤵
- Suspicious use of WriteProcessMemory
PID:1544
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\SilverBullet.1.4.1.Pro\SilverBullet 1.4.1 [Pro]\lib\email\_header_value_parser.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2536
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\SilverBullet.1.4.1.Pro\SilverBullet 1.4.1 [Pro]\lib\email\_header_value_parser.py"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
5a5581ca8834109f1aef9d016de8c4ad

SHA1
1db61135d66b2eac7c3c0b551bb5edc4730d952a

SHA256
df29fee3c24fe2b17efb45cb1942df0806f154eada256695c6ffab96ed7b5a77

SHA512
2eae0f9038244ee2feed9b9fd186fcc08ad2e331b6b3104b9443e0d049089a6caa31e3ad93c4b71d37e0cd239588cdbe068605d98b20a1f6839c5a2defcc8ef8

Download Submit